AI coding tools are genuinely useful. I use them. They write boilerplate, sketch tests, and remember syntax I stopped memorizing years ago.

But here's the thing nobody puts in the demo: the code they write is plausible. It looks right. It reads right. And that is exactly what makes it dangerous.

Plausible is the problem

Bad code that looks bad gets caught. Bad code that looks clean gets merged.

An AI tool is very good at producing code shaped like the code around it. It is much less good at knowing the rules your app depends on that aren't written down in the file it's looking at.

The missing scope

Here's a pattern you'll see in a lot of multi-tenant Laravel apps:

public function show(Invoice $invoice)
{
    return view('invoices.show', compact('invoice'));
}

It looks fine. Route model binding, clean controller, done.

Except in a multi-tenant app, that just let any logged-in user view any invoice by changing the ID in the URL. The version that respects your rules looks like this:

public function show(Invoice $invoice)
{
    $this->authorize('view', $invoice);
 
    return view('invoices.show', compact('invoice'));
}

One line. The tool didn't know the policy existed, or that it mattered. You do.

The happy path fetch

Same story in TypeScript:

const res = await fetch(`/api/orders/${id}`);
const order: Order = await res.json();

fetch doesn't throw on a 404 or a 500. So now order is an error payload wearing an Order type, and the bug shows up three components later.

const res = await fetch(`/api/orders/${id}`);
if (!res.ok) {
  throw new Error(`Order ${id} failed: ${res.status}`);
}
const order: Order = await res.json();

The type annotation was never a check. It was a promise nobody kept.

Review it like a stranger wrote it

Because one did. When I review AI-generated code, I ask the same questions I'd ask about a pull request from someone on their first week:

• Does this respect auth and tenancy rules?
• What happens when the network, the API, or the input is wrong?
• Did it invent a method, a config key, or a package that doesn't exist?
• Would I be comfortable explaining this line in a code review?

If I can't explain it, it doesn't ship. Doesn't matter who or what typed it.

Your name is on the commit

The tool doesn't get paged at 2 a.m. It doesn't sit in the postmortem. You do.

Use the tools. Let them do the typing. Just don't let them do the thinking you're getting paid for.